diff --git a/src/api/s3/delete.rs b/src/api/s3/delete.rs index 0ef1bf33..5370a1e8 100644 --- a/src/api/s3/delete.rs +++ b/src/api/s3/delete.rs @@ -132,6 +132,14 @@ fn parse_delete_objects_xml(xml: &roxmltree::Document) -> Option } for item in delete.children() { + // Only parse nodes + if !item.is_element() { + // text nodes are allowed only if they contain whitespace characters only + if !item.text()?.trim().is_empty() { + return None; + } + } + if item.has_tag_name("Object") { let key = item.children().find(|e| e.has_tag_name("Key"))?; let key_str = key.text()?;